Zyxel security advisory for OS command injection vulnerability of firewalls
CVE: CVE-2023-28771
Summary
Zyxel has released patches for an OS command injection vulnerability found by TRAPA Security and urges users to install them for optimal protection.
What is the vulnerability?
Improper error message handling in some firewall versions could allow an unauthenticated attacker to execute some OS commands remotely by sending crafted packets to an affected device.
What versions are vulnerable—and what should you do?
After a thorough investigation, we’ve identified the vulnerable products that are within their vulnerability support period and released patches to address the vulnerability, as shown in the table below.
Affected series | Affected version | Patch availability |
---|---|---|
ATP | ZLD V4.60 to V5.35 | ZLD V5.36 |
USG FLEX | ZLD V4.60 to V5.35 | ZLD V5.36 |
VPN | ZLD V4.60 to V5.35 | ZLD V5.36 |
ZyWALL/USG | ZLD V4.60 to V4.73 | ZLD V4.73 Patch 1 |
Got a question?
Please contact your local service rep or visit Zyxel’s forum for further information or assistance.
Acknowledgment
Thanks to TRAPA Security for reporting the issue to us.
Revision history
2023-4-25: Initial release
Comments
-
There is no download link for the patch. I am getting repeatedly hit with attack zyxel command injection - CVE-2023-28771 on udp port 500. I NEED THE PATCH!
0 -
log in here and get it
0
Categories
- All Categories
- 414 Beta Program
- 2.2K Nebula
- 130 Nebula Ideas
- 91 Nebula Status and Incidents
- 5.4K Security
- 174 USG FLEX H Series
- 256 Security Ideas
- 1.4K Switch
- 71 Switch Ideas
- 1K Wireless
- 36 Wireless Ideas
- 6.2K Consumer Product
- 235 Service & License
- 372 News and Release
- 79 Security Advisories
- 24 Education Center
- 5 [Campaign] Zyxel Network Detective
- 2.9K FAQ
- 34 Documents
- 34 Nebula Monthly Express
- 80 About Community
- 69 Security Highlight